Subject: Authentication and draft-ietf-6man-hbh-processing

From: Toerless Eckert <[email-masked]>
Date: Tue, 22 Mar 2022 16:46:10 +0100

During todays 6man meeting i repeated my core interest to ensure that we
do get some mandate that routers MUST be able to forward but ignore HBH
extension headers (up to TBD maximum length and maximum number).

But i think i was missing one point:

There may be a HBH extension header that i as an SP will perfectly want to
act on... BUT only for traffic that is authenticated to be treated. For
example only traffic from my own customers - or to my own customers. But
not for transit taffic (no business relationship to give that transit traffic
the advantageous treatment the HBH header will give).

So, how do i do this ?

One simple option is a simple Auth bit for HBH headers whenever a packet
enters my network, network ingres would clear the bit and only set it if the packet
matches the appropriate authentication rules (which for above example
could be as simple as incoming-interface-from-subscriber, or destination-address-to-subscriber.

And with bit cleared, the header is just ignored. With bit set, the header
is ignored based on whether or not the router along the path fancies to support it.

Not sure if this line of thought had been brought up in before. If it did,
i apologize for duplication.

Cheers
    Toerless

---

From: Michael Richardson <[email-masked]>
Date: Tue, 22 Mar 2022 18:44:26 +0100

Toerless Eckert <[email-masked]> wrote:
    > One simple option is a simple Auth bit for HBH headers whenever a
    > packet enters my network, network ingres would clear the bit and only
    > set it if the packet matches the appropriate authentication rules
    > (which for above example could be as simple as
    > incoming-interface-from-subscriber, or
    > destination-address-to-subscriber.

IPv6 does need to grow feature parity with IPv4.
IPv4 has RFC3514.org!

So, yeah, you have manage the EVIL bit correctly at every ingress.
I know that diffserv and MPLS and ATM and ... all had this requirement too.
It's sad that we still don't really have a good way to do this cross-vendor.

The entire APN architecture seems to be trying to provide this facility, btw.

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-